What POA&Ms are
Secureframe's POA&M (Plan of Action and Milestones) module is a centralized view that helps you document, track, manage, and update remediation plans for compliance gaps. Each POA&M item captures a description of the issue, the associated assessment objectives, planned remediation steps, a responsible owner, a target completion date, and current status.
Under CMMC Level 2 as designed, gaps you can't close immediately are documented in POA&Ms with a 180-day remediation window, so keeping this module current is part of keeping your program defensible.
Access the POA&M table
From the left-hand navigation, under Defense, select POA&M.
Creating a POA&M item from the POA&M table
Click the + button in the POA&M table.
Fill in the required details: Issue (how you are failing to meet the linked assessment objective(s)), Owner (the person responsible for remediating the item), and Associated assessment objectives (link the relevant objectives).
Creating a POA&M item from the Control Implementation page
From the Control Implementation page of your System Security Plan, you can create a POA&M item directly linked to any of your control requirements. When you create it this way, the Issue field pre-fills from the assessment objective, so you start from a draft instead of a blank form.
POA&M items are created by you, from either of these two paths, so you decide what is formally documented as a gap.
POA&M statuses
Draft: The default status when a POA&M item is created.
In Progress: Indicates active work on the item. When marked In Progress, the due date is automatically set 180 days out, matching the CMMC remediation window.
Closed: Remediation is complete. The item remains in the system to maintain historical records.
Overdue: If an item remains In Progress past its due date, the due date turns red with an overdue indicator.
Track remediation plans
Each POA&M item includes fields for the estimated completion date and the remediation plan. Use them to outline your timeline and approach for resolving the issue.
In the Attachments tab, upload supporting documents or evidence of remediation. These matter for demonstrating resolution later. Use the Comments tab to collaborate with stakeholders throughout the remediation process.
Frequently Asked Questions (FAQ)
How do I access the POA&M module?
POA&M is available on select plans. If you do not currently see it, contact [email protected] or reach out to your Account Manager.
Why is the assessment objectives dropdown empty when I create a POA&M item?
The dropdown lists assessment objectives from your SSP. If it is empty, there may be no objectives available or linked to the current requirement yet.
Can I manage POA&M items programmatically?
Yes. POA&M items can be created, listed, updated, and removed through Secureframe's API. See developer.secureframe.com for details.
Questions? Contact [email protected] or reach out to your CSM.